From e1f5e4c8006d81624e73d9a2f56d21a767dfe54a Mon Sep 17 00:00:00 2001
From: KingKDot <why_are_you_looking_at_this@stoppeeping.com>
Date: Sun, 21 Jun 2026 18:55:01 -0500
Subject: [PATCH] fix user api issue

---
 .../routes/permission-groups-routes.test.ts   | 45 +++++++++++++++++++
 .../src/server/routes/users-routes.ts         |  2 +-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/Overlord-Server/src/server/routes/permission-groups-routes.test.ts b/Overlord-Server/src/server/routes/permission-groups-routes.test.ts
index 3282b18..3efe339 100644
--- a/Overlord-Server/src/server/routes/permission-groups-routes.test.ts
+++ b/Overlord-Server/src/server/routes/permission-groups-routes.test.ts
@@ -8,7 +8,9 @@ import {
   getUserById,
   setUserGroups,
 } from "../../users";
+import { createHttpFetchHandler } from "../http-dispatch";
 import { handlePermissionGroupsRoutes } from "./permission-groups-routes";
+import { handleUsersRoutes } from "./users-routes";
 
 const PASSWORD = "Aa1!PgRoutesTestPassword";
 
@@ -45,6 +47,28 @@ function call(method: string, path: string, token: string | null, body?: unknown
   );
 }
 
+function callThroughServerRoutes(method: string, path: string, token: string | null, body?: unknown) {
+  const url = new URL(`https://localhost${path}`);
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  const handler = createHttpFetchHandler({
+    metrics: { withHttpMetrics: (fn) => fn() },
+    CORS_HEADERS: {},
+    routes: [
+      (req, routeUrl, server) => handleUsersRoutes(req, routeUrl, server as typeof mockServer),
+      (req, routeUrl, server) => handlePermissionGroupsRoutes(req, routeUrl, server as typeof mockServer),
+    ],
+  });
+  return handler(
+    new Request(url, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+    }),
+    mockServer,
+  );
+}
+
 afterEach(() => {
   while (createdGroupIds.length > 0) {
     const id = createdGroupIds.pop();
@@ -206,6 +230,27 @@ describe("permission-groups routes — user assignments", () => {
     expect(body.groupIds).toEqual([group.id]);
   });
 
+  test("server route order lets empty user group assignment reach permission-groups handler", async () => {
+    const admin = await tempUser("admin");
+    const target = await tempUser("viewer");
+
+    const putRes = await callThroughServerRoutes(
+      "PUT",
+      `/api/users/${target.user.id}/permission-groups`,
+      admin.token,
+      { groupIds: [] },
+    );
+    expect(putRes.status).toBe(200);
+
+    const getRes = await callThroughServerRoutes(
+      "GET",
+      `/api/users/${target.user.id}/permission-groups`,
+      admin.token,
+    );
+    expect(getRes.status).toBe(200);
+    await expect(getRes.json()).resolves.toEqual({ groupIds: [] });
+  });
+
   test("PUT /api/users/:id/extra-permissions sanitizes unknown perms", async () => {
     const admin = await tempUser("admin");
     const target = await tempUser("viewer");
diff --git a/Overlord-Server/src/server/routes/users-routes.ts b/Overlord-Server/src/server/routes/users-routes.ts
index e216bfd..62dfb13 100644
--- a/Overlord-Server/src/server/routes/users-routes.ts
+++ b/Overlord-Server/src/server/routes/users-routes.ts
@@ -607,7 +607,7 @@ export async function handleUsersRoutes(
       });
     }
 
-    return new Response("Not found", { status: 404 });
+    return null;
   } catch (error) {
     if (error instanceof Response) {
       return error;